Extracted

• • Target

    cfda50dfa3a323daf2ada9dadf993a2fc35587f288da3450b69b71e1c17b43e1.exe

  • Size

    1.1MB

  • MD5

    0eee7af022b90b951f9284d4fadf88be

  • SHA1

    e4a76a60e48b6b5f42b8224859a2d368cce5a1f5

  • SHA256

    cfda50dfa3a323daf2ada9dadf993a2fc35587f288da3450b69b71e1c17b43e1

  • SHA512

    c4c5b5e1b0aba27f6ff62b887970d409fde27b1d6fabdcd51edcc3e329138cb0a50599bc73084f8932a35a84cb891df6c937fd7b10a7c701acc3a20f1e8322f7

  • SSDEEP

    24576:uRmJkcoQricOIQxiZY1iaC9naYeCPZupXQpBM9lnqYHS:7JZoQrbTFZY1iaCtamZoXQBWlnqYHS

  Score

  10^/10

  agenttesladiscoverykeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2